Macie
Amazon Macie finds sensitive data in S3, such as personal information, credentials and financial records, and reports buckets that expose it. The platform ships Macie wired to core-security and switched off until a deployment needs it.
What it does
Macie keeps an inventory of every S3 bucket in an account, with its encryption, public access and sharing status, and watches for changes that weaken them. On top of the inventory, sensitive data discovery jobs read objects and use managed data identifiers to spot names, addresses, card numbers, access keys and similar content. Each result is a finding: a policy finding for a risky bucket setting, or a sensitive-data finding for content. In an organization, a delegated administrator account enables Macie for every member and collects their findings.
How BuiltForProd uses it
Macie follows the same three-step pattern as GuardDuty, controlled by one switch in environments/core/security/security.hcl:
| Step | Unit | Account | Effect when enable_macie = true |
|---|---|---|---|
| 1 | macie | core-security | Opens the Macie session with the configured finding publishing frequency |
| 2 | macie-delegation | core-root | Names core-security as the Macie delegated administrator |
| 3 | macie again | core-security | With org_auto_enable.macie = true, enables Macie in every member account automatically |
Both units read the same file, so the two accounts cannot disagree. Like GuardDuty and Security Hub, Macie needs its session in core-security before delegation, which is why step 1 comes first.
The default is off because the cost scales with data: the switch file records about $0.10 per S3 bucket per month for inventory and monitoring, plus about $1 per GB inspected by discovery jobs. For a platform whose largest stores are a data lake and audit logs, that is a decision for the organization that owns the data, not a default. When on, Security Hub imports Macie findings through its product integration, which follows the same switch.
Macie is one of several controls on the same buckets. Whether or not it is on, every account except core-public has the account-level public access block, Security Hub findings about public buckets trigger automatic remediation, and the data lake denies direct S3 reads to everything except Lake Formation, the Glue role and administrators.
Terms you will see
| Term | Meaning |
|---|---|
| Session | The per-account, per-region Macie enablement. |
| Bucket inventory | Macie's continuously updated list of buckets and their security settings. |
| Sensitive data discovery job | A scheduled or one-off scan of objects for sensitive content. |
| Managed data identifier | A built-in detector for a category of sensitive data, such as a card number. |
| Policy finding | A finding about a bucket setting, such as public access or missing encryption. |
| Delegated administrator | The account that runs Macie for the organization; core-security. |
| Finding publishing frequency | How often Macie sends findings to EventBridge and Security Hub. |
Where to read more
- AWS Baseline overview for the security services and their cost-aware defaults.
- S3 for the buckets Macie would inventory.
- Lake Formation for how access to the data lake is governed.